fix: let authenticated users connect Google/GitHub from Settings

[paulocastellano]

Summary

Fixes a bug in the Settings → Authentication "Connect" button: clicking it while logged in was bouncing the user to /app/home (because the OAuth redirect lived behind guest middleware) and would have corrupted the session even if it had reached the callback (different-email GitHub account → new user registered, original user logged out).

Root cause

Two compounding issues:

1. Routing: auth.{provider}.redirect and auth.{provider}.callback were both inside routes/auth.php's guest group. Authenticated users couldn't reach either.
2. Callback logic: The callbacks had no branch for "user is already authenticated and wants to link a provider". They ran the lookup-or-register flow, which would either silently swap the session to a different account (if the OAuth email matched another user) or create a brand-new account (if it didn't).

The fix

Splits signup/login from connect-from-settings by intent, not by guessing in the callback:

• New route app.authentication.connect-provider in routes/app.php's auth group, handled by App\Settings\AuthenticationController::connectProvider. Sits next to disconnectProvider for symmetry.
• auth.{provider}.redirect stays in the guest group (original behavior: signup/login only).
• auth.{provider}.callback moves out of guest since OAuth providers only allow one registered callback URL — it has to accept both flows. It gains a single Auth::check() branch that delegates to connectToCurrentUser().
• connectToCurrentUser() refuses to rebind a provider id that's already tied to a different user (flash error → settings); otherwise updates the current user's {provider}_id and flashes success.
• Authentication.vue now uses connectProvider(account.provider) instead of the OAuth signup link.

Test plan

• tests/Feature/Auth/ConnectProviderTest.php — 9 tests covering route accessibility (auth required, unknown provider 404, both providers redirect to OAuth) and callback behavior (link to current user including different-email case, reject when already linked elsewhere).
• Existing OAuth tests for signup/login still pass — the guest-group redirect routes are unchanged.
• Full suite: 1396 pass / 2 skipped.
• Pint clean.

Why not separate callback URLs

OAuth providers (Google, GitHub) only let you register a fixed list of callback URLs per app. Splitting signup vs connect into separate URLs would mean a second URL registered in each provider's console plus a second env var per provider — overhead with no real win, since the callback's branch is one if (Auth::check()) line. The middleware separation on the redirect routes is what guarantees the branch is safe (a guest can never reach the connect-provider route, and an authenticated user is bounced from auth.{provider}.redirect by the guest middleware).